Skip to content
HackIndex logo

HackIndex

FTP Banner & Server Enumeration

2 min read Jan 4, 2026

This phase identifies what FTP server is running and how it is configured.

Grab Service Banner and System Details

┌──(kali㉿kali)-[~]
└─$ nmap -p 21 -sV --script ftp-syst $TARGET_IP 
| ftp-syst:
|   STAT:
| FTP server status:
|      Connected to 192.0.2.13
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 1
|      vsFTPd 2.0.5 - secure, fast, stable
|_End of status

Reveals:

  • FTP daemon name

  • Operating system

  • System type and architecture

Retrieve FTP Banner Manually

┌──(kali㉿kali)-[~]
└─$ nc $TARGET_IP 21

Manual banner grabbing is useful when:

  • Nmap output is filtered or incomplete

  • You want raw, unprocessed responses

  • Testing connectivity without scripting

For FTPS (Explicit TLS): Wrap the connection with OpenSSL to handle the TLS upgrade:

┌──(kali㉿kali)-[~]
└─$ openssl s_client -connect $TARGET_IP:21 -starttls ftp

Then send commands manually (e.g., type QUIT to see the banner/response). Add -quiet to suppress certificate warnings during testing.

Check Supported FTP Features (FEAT)

┌──(kali㉿kali)-[~]
└─$ nc $TARGET_IP 21
FEAT

Identifies supported extensions such as:

  • UTF8

  • AUTH TLS

  • Passive mode behavior

  • Extended commands

Unexpected or outdated features may indicate weak security controls.

For FTPS: Use the OpenSSL-wrapped connection above, send AUTH TLS first if needed, then FEAT.

This information helps identify the exact server software/version for targeted vulnerability research in later phases.